Re: AW: Request for Whitelisting or Spam Score Adjustment for our TDL Domain

2025-02-13 Thread Richard Doyle
On 2/13/25 10:25 AM, Benny Pedersen wrote: > wissen.online | Stefan Mehlhorn skrev den 2025-02-13 19:02: >> Hi Benny, Hi Levine, >> >> tnx! Wissen.online it also the name of our company ... so we need .online >> and not wissenonline.de (ist another company) >> >>> stop using send emails from pbl li

Re: Question about the 'URIBL_BLOCKED' rule

2020-04-30 Thread Richard Doyle
First result on Google: http://cweiske.de/tagebuch/uribl_blocked.htm Short version: URIBL will block you if you use any of the big DNS providers, such as 8.8.8.8. On 4/30/20 11:59 AM, Tom Williams wrote: > Hi!  I'm new to this mailing list, but not new to SpamAssassin. I've > used it on and off

Re: RDNS_NONE always being triggered

2016-01-04 Thread Richard Doyle
On 01/04/2016 05:46 AM, Reindl Harald wrote: > > > Am 04.01.2016 um 13:53 schrieb a.sm...@ldexgroup.co.uk: >> On Jan 4, 2016, 3:42 AM, rwmaillists at googlemail wrote: >>> >>> No look-up is done. RDNS_NONE tests whether rdns is recorded in the >>> received header. You need either to turn it on or t

Re: Filtering snowshoe spam

2015-10-29 Thread Richard Doyle
On 10/29/2015 01:04 PM, Bill Cole wrote: > On 29 Oct 2015, at 11:09, Alex wrote: > >> Hi, >> >> I've been receiving tons of messages not being tagged by spamassassin >> on one host, despite it hitting bayes999, and wanted to see if there >> was something that could be done. >> >> http://pastebin.co

Re: Barracuda / EmailReg.org protection racket? (OT, but help?)

2015-06-20 Thread Richard Doyle
On 06/20/2015 08:38 AM, Jered Floyd wrote: > > Hello SA-users, > > I have a question on the other side of things: outgoing mail. I know > this is off-topic but this seems to the only venue where there might > be knowledge of the problem, and the offender is a spamassassin > "customer". > > (I oper

Re: Uptick in spam

2015-03-27 Thread Richard Doyle
On 03/27/2015 03:44 PM, Amir Caspi wrote: > On Mar 27, 2015, at 3:34 PM, Richard Doyle > wrote: > >> All of these were "From:" domains created today. > Shouldn't they have been picked up by DOB? Or do I need to manually enable > some DOB plugin in SA? (If so

Re: Uptick in spam

2015-03-27 Thread Richard Doyle
On 03/27/2015 11:51 AM, Amir Caspi wrote: > On Mar 27, 2015, at 12:20 PM, Axb wrote: > >> - Please post missed spam samples in pastebin.com - do not post samples to >> mailing lists > Of course, I would never post it to the list. I will put up a few in > pastebin but there are so many of them,

Re: Googlasi, blacklotus, etc.

2014-10-02 Thread Richard Doyle
It is a new domain, created September 30 with namecheap. An effective "new domain" system would catch lots of similar spam. Oh, and I'm another satisfied invaluement customer. On 09/30/2014 10:41 AM, David Jones wrote: >> >> From: Philip Prindeville >> S

Re: Funky HARP Spam

2014-06-25 Thread Richard Doyle
On 06/25/2014 02:12 PM, Philip Prindeville wrote: > On Jun 25, 2014, at 2:58 PM, Axb wrote: > >> On 06/25/2014 10:21 PM, Philip Prindeville wrote: >> >>> http://pastebin.com/qLyKx40b >> "This paste has been removed!" :( > I’ve temporarily posted it on ftp://ftp.redfish-solutions.com/pub/harp.eml I

Re: Domain ages (was Re: SPAM from a registrar)

2014-06-09 Thread Richard Doyle
On 06/09/2014 02:42 PM, Matthias Leisi wrote: > > On Mon, Jun 9, 2014 at 11:31 PM, Richard Doyle > mailto:lists...@islandnetworks.com>> wrote: > > > A caching whois client (jwhois, for example) can significantly reduce > the volume of queries. > > >

Re: Domain ages (was Re: SPAM from a registrar)

2014-06-09 Thread Richard Doyle
On 06/09/2014 12:29 PM, Kevin A. McGrail wrote: > On 6/9/2014 3:24 PM, Patrick Domack wrote: >> The point was, I have already done this, and have it in production. I >> did this cause this subject keeps coming up from time to time, and I >> was personally interested to see the results of it. >> >>

Re: .pw / Palau URL domains in spam

2013-05-08 Thread Richard Doyle
Hypotheticians might want to look at jwhois, which is a caching whois client. Cache expiration time is configurable ... On 05/08/2013 06:45 AM, Chris Santerre wrote: > RE: .pw / Palau URL domains in spam > > Hypothetically if one were running a reputation system and didn't want > to block all of

SURBL malware list vs. sa-update

2013-05-05 Thread Richard Doyle
SURBL has reorganized its lists and provided a new spamassassin configuration to support those changes: http://lists.surbl.org/pipermail/announce/2013-May/000209.html I'm using sa-update (version 3.003001) and noticed that 25_uribl.cf already contains the new configuration, but with all lines comm

Re: short prolific spam

2012-10-01 Thread Richard Doyle
On 10/01/2012 09:53 AM, JP Kelly wrote: > I am getting a bunch of particularly annoying spam which always has a short > html body message similar to: > > HELLO dude > > Any ideas how to combat this spam? Lower your threshold to 5. > > Here is an example: > > X-Spam-Checker-Version: SpamAssass

Re: Spam from Moniker Privacy Services.

2012-03-30 Thread Richard Doyle
On 03/29/2012 05:10 PM, Frank Chan wrote: On 02-03-2012 15:49, Frank Chan wrote: Here are some samples of this spam in pastebin: http://pastebin.com/djidF7dg http://pastebin.com/DQan00ve http://pastebin.com/1PizAzMv http://pastebin.com/Hd6vVpYi Thank you, Frank On 02-03-2012 14:31, Jeremy McS

Re: strange problem here with spam detection

2012-03-23 Thread Richard Doyle
On 03/23/2012 11:23 AM, RW wrote: On Fri, 23 Mar 2012 11:54:47 -0400 Kiryl Hakhovich wrote: so here is my observation is that when email come spamd does less rules checking or something??? vs when i ran it manually via sa-learn it yell a lot more rules being detected. could it be that there

Re: Apparent FP with URI_HEX

2010-09-14 Thread Richard Doyle
imilarly, uribl-black objects to backup.sh I'm not surprised that a message like this hits a number of rules. > On Tue, Sep 14, 2010 at 4:54 PM, Richard Doyle > wrote: > > On Tue, 2010-09-14 at 16:46 -0400, Glendon Solsberry wrote: > >> I have messages that are being flagg

Re: Apparent FP with URI_HEX

2010-09-14 Thread Richard Doyle
On Tue, 2010-09-14 at 16:46 -0400, Glendon Solsberry wrote: > I have messages that are being flagged via URI_HEX, without having > *any* 'http' in them. Any help would be greatly appreciated. Snippage contains http://141641

Re: URL Block Lists

2009-07-22 Thread Richard Doyle
On Wed, 2009-07-22 at 22:52 -0400, MySQL Student wrote: > Hi, > > What is the preferred list of URL block lists that everyone uses? I'm > currently using SURBL and a few others, often times there are URLs > like 'learningbetter.net' that isn't tagged. http://dnsbl.invaluement.com/ivmuri/ Very ta

RE: sa-update

2008-10-23 Thread Richard Doyle
On Thu, 2008-10-23 at 19:43 -0400, Jean-Paul Natola wrote: > I used to get about 19-15 spam messages in my box per week, now , eve today I > got 11- > > and they are hardly hitting any rules, anything new (rbl's etc..) I should > look into? jm_sought rules are useful http://wiki.apache.org/spam

Re: EmailReg Whitelist

2008-10-15 Thread Richard Doyle
On Wed, 2008-10-15 at 15:20 -0700, Bill Landry wrote: > Just wondering if anyone has had any experience with this particular > whitelist: > > http://www.emailreg.org/ Their confirmation message scored on DNS_FROM_OPENWHOIS, WHOIS_PRIVPROT and MIME_HTML_ONLY BODY, adding 6.9 points to the score!

double letter porn

2006-10-04 Thread Richard Doyle
I've been getting lots of porn site spam containing words with doubled letters, like this one: Orrgy pornn parrties! Lotts of sttupid bitchees gangbangged by queue of guyss. annal_nailing and cum__swallowing orgiees. archiive of group_ssex materia